Knowledge + Practice

Splunk Core Certified Power User SPLK-1003 (SPLK-1002) — Questions 151–225

475 questions total · 7pages · All types, answers revealed

Take a mock exam Exam hub

Page 3 of 7

151

MCQhard

A Splunk administrator uses a macro to normalize firewall logs into the CIM Network Traffic data model. The macro includes a field alias that maps `bytes_sent` to `bytes_out`. The mapping works in ad-hoc searches, but when the macro is used in a summary index search, the field is not populated. What is the most likely reason?

A.The alias creates a new field that is not included in the summary index output.

B.The summary index is accelerated and overrides the alias.

C.Field aliases are not supported in macros.

D.The macro is not shared to the global context, so it fails in summary indexing.

AnswerA

Search-time aliases create new fields; if the summary index only stores original fields, the aliased field may not be stored unless explicitly kept.

Why this answer

The macro applies the field alias at search time, but summary index searches store the results of the search output. Since the alias field `bytes_out` is derived from `bytes_sent` and not a native field in the data, it is not automatically included in the summary index unless explicitly referenced in the search output. Therefore, the field is not populated in the summary index, making option A the correct answer.

Full explanation →

152

Multi-Selectmedium

Which TWO of the following are valid ways to create a macro in Splunk? (choose two)

Select 2 answers

A.Add a macro definition to props.conf under a [source] stanza.

B.Use the CLI command `splunk add macro` with the macro definition.

C.Navigate to Settings > Advanced search > Search macros and click 'New'.

D.Create a macros.conf file in $SPLUNK_HOME/etc/system/local/ and add the macro definition.

E.Edit the macros.conf file in the app's default directory.

AnswersC, D

This is the UI method.

Why this answer

Splunk provides a GUI-based method to create macros via Settings > Advanced search > Search macros, which is a standard and supported approach. Option D is correct because manually creating a macros.conf file in $SPLUNK_HOME/etc/system/local/ is a valid configuration method that Splunk reads at startup to define macros.

Exam trap

The trap here is that candidates may confuse the valid configuration file location (local directory) with the default directory, or mistakenly think a CLI command exists for macro creation, when Splunk only supports GUI or manual file-based methods.

Full explanation →

153

MCQhard

A team uses a large index with many sourcetypes. They want to identify categories of events that have at least 100 occurrences, compute the average response_time per category, and return the top 5 categories with the highest average response_time. Which search best optimizes performance?

A.index=main | eventstats avg(response_time) as avg by category | stats count as cnt by category | where cnt>=100 | sort -avg | head 5

B.index=main | top category | eval avg=avg(response_time) | where count>=100

C.index=main | stats avg(response_time) as avg by category | where cnt>=100 | sort -avg | head 5

D.index=main | stats avg(response_time) as avg, count as cnt by category | where cnt>=100 | sort -avg | head 5

AnswerD

This option computes both average and count per category correctly, but it still does not filter events by status or response_time, which is the primary requirement of the question.

Why this answer

Option D is correct because it uses a single stats command to compute both avg(response_time) and count (cnt) by category, then filters, sorts, and limits the results efficiently. Option A uses eventstats followed by stats—this is less efficient and the avg field is lost after stats count, making the sort invalid. Option B uses the top command, which does not compute the correct average and may not properly enforce the count threshold across all categories.

Option C computes avg by category but omits the count, so the where cnt>=100 condition will fail.

Exam trap

This question tests the ability to identify the most efficient use of stats aggregations. Candidates may mistakenly select options that use multiple piped commands (like eventstats) for what can be accomplished with a single stats, assuming they are more powerful, when in fact they add overhead.

How to eliminate wrong answers

Option A is wrong because it uses eventstats to compute an average per category but then does not filter on status or response_time, and the where clause references cnt>=100 without defining cnt in the pipeline, leading to incorrect results and unnecessary computation. Option B is wrong because top category returns the most common categories without any filtering on status or response_time, and eval avg=avg(response_time) is invalid in a non-aggregating context, causing a syntax error. Option C is wrong because it computes avg(response_time) but omits the count field, so the where cnt>=100 clause fails due to cnt not being defined, and it does not filter on status or response_time.

Full explanation →

154

MCQhard

A search uses the map command to run a search for each value of a field. The search is taking a very long time. Which alternative approach is recommended for better performance?

A.Use the sort command

B.Use a subsearch with the IN operator instead

C.Use the transaction command

D.Use the foreach command to loop over fields

AnswerB

Subsearch performs a single lookup instead of per-event search

Why this answer

Replacing a `map` command with a subsearch using the `IN` operator allows Splunk to retrieve all matching field values in a single search pass, rather than executing a separate search for each value. The `map` command runs one search per input row, which can cause significant overhead and slow performance, especially with large result sets. Using `IN` in a subsearch collects the values first and then applies them as a filter in the outer search, reducing the number of search operations to one.

Exam trap

Splunk often tests the misconception that `map` is the only way to run a search for each value of a field, when in fact a subsearch with `IN` achieves the same result more efficiently by avoiding iterative search execution.

How to eliminate wrong answers

Option A is wrong because the `sort` command only reorders results and does not reduce the number of searches or improve the performance of a `map`-based workflow. Option C is wrong because the `transaction` command groups events into transactions based on fields or time, but it does not replace the iterative search behavior of `map` and can itself be resource-intensive. Option D is wrong because the `foreach` command iterates over fields within a single result row, not over multiple search executions, so it cannot replace the per-value search logic of `map`.

Full explanation →

155

MCQmedium

Refer to the exhibit. What happens when a user clicks on a status value in the table?

A.Nothing happens; the token is not used

B.Both the table and chart update

C.The table filters to show only events with that status

D.The chart updates to show methods for that status

AnswerD

The chart search uses $selected_status$ and refreshes when the token changes.

Why this answer

Clicking a status value sets a token ($selected_status$) that triggers a search refresh for the chart panel, which depends on that token. This causes the chart to update to show methods for the selected status. The table does not change because it has no dependency on the token.

Option A is incorrect because the token is indeed used and the chart updates. Option B is incorrect because only the chart updates, not the table. Option C is incorrect because the table does not filter; only the chart updates.

Full explanation →

156

MCQmedium

A company uses a large Splunk environment with many users creating dashboards. They notice that some searches are slow and consume excessive resources. What is the best practice to optimize search performance?

A.Use the tstats command with summariesonly=t

B.Use the search command with a large time range

C.Use the eval command to create new fields

D.Use the stats command with by clause on high cardinality fields

AnswerA

Uses pre-summarized accelerated data, significantly faster.

Why this answer

The `tstats` command with `summariesonly=t` is the best practice because it queries accelerated data models or summary indices rather than raw event data, drastically reducing the amount of data scanned. This command leverages pre-computed statistics, which is the most efficient way to perform searches over large datasets, especially when users are building dashboards that run repeatedly.

Exam trap

Splunk often tests the misconception that `tstats` is only for advanced users or that it requires a data model, but the trap here is that candidates confuse `tstats` with `stats` and think any aggregation command is equally efficient, ignoring the critical role of summary acceleration.

How to eliminate wrong answers

Option B is wrong because using the `search` command with a large time range forces Splunk to scan all raw events across that entire period, which is resource-intensive and slow, the opposite of optimization. Option C is wrong because the `eval` command creates new fields at search time, adding computational overhead and not reducing the data volume; it does not leverage any pre-computed summaries. Option D is wrong because using the `stats` command with a `by` clause on high cardinality fields (e.g., user IDs or IP addresses) creates many distinct groups, consuming significant memory and CPU, and can even cause search failures due to memory limits.

Full explanation →

157

MCQmedium

An analyst wants to create a running total of sales per day over a week. The data has fields: date, sales. Which search would produce a cumulative sum for each day?

A.... | eval running_total = running_sum(sales)

B.... | sort date | streamstats sum(sales) as running_total

C.... | eventstats sum(sales) as running_total

D.... | stats sum(sales) by date

AnswerB

streamstats with sum calculates cumulative sum over sorted events.

Why this answer

It first sorts the events by date to ensure chronological order, then uses `streamstats` to compute a running (cumulative) sum of sales across each event in that order. `streamstats` processes events sequentially and adds the current value to the accumulated total, producing a cumulative sum per day.

Exam trap

Splunk often tests the distinction between `streamstats` (sequential, cumulative) and `eventstats` (non-sequential, global aggregate), and candidates mistakenly choose `eventstats` thinking it computes a running total because it adds a field to each event.

How to eliminate wrong answers

Option A is wrong because `running_sum()` is not a valid Splunk function; the correct function for cumulative sums is `streamstats sum()`. Option C is wrong because `eventstats` computes an aggregate statistic (e.g., total sum) over the entire result set and adds it to each event, not a running total per day. Option D is wrong because `stats sum(sales) by date` returns a single total per day, not a cumulative sum that grows across days.

Full explanation →

158

MCQhard

A large organization uses Splunk to monitor its network infrastructure. They have a single saved search that runs every hour to create a summary index for each of the 50 network device sourcetypes. The saved search uses a macro named `build_network_summary` that accepts two arguments: `sourcetype` and `time_range`. The macro definition is: ``` [build_network_summary] definition = index=network sourcetype=$sourcetype$ earliest=$time_range$ latest=now | stats count by src_ip, dest_ip, protocol | collect index=network_summary args = sourcetype, time_range iseval = 0 ``` The saved search iterates over the 50 sourcetypes using a separate lookup or list. Recently, the security team noticed that the network_summary index is missing data for certain sourcetypes, specifically those with hyphens in their names (e.g., `cisco-asa`, `juniper-srx`). For other sourcetypes, the summary is complete. The saved search runs without errors in Splunk's job inspector. Which course of action should the administrator take to resolve the issue?

A.Increase the summary index range to cover all sourcetypes in one pass rather than iterating.

B.Modify the macro definition to enclose the `$sourcetype$` argument in quotation marks: `sourcetype="$sourcetype$"`

C.Change the macro's time_range argument to use a static time range to avoid relative time issues.

D.Enable acceleration on the network_summary index to improve data completeness.

AnswerB

Quoting prevents hyphens from being interpreted as search operators.

Why this answer

When a macro argument contains special characters like hyphens, Splunk may misinterpret them as operators (e.g., subtraction) or search syntax modifiers. Enclosing the `$sourcetype$` argument in quotation marks, i.e., `sourcetype="$sourcetype$"`, ensures the entire value is treated as a literal string, preventing parsing errors for sourcetypes with hyphens. Option A is incorrect because increasing the index range doesn't address the parsing issue.

Option C is unrelated to the sourcetype name problem. Option D is irrelevant as acceleration does not fix data ingestion or search syntax issues.

Full explanation →

159

Multi-Selecteasy

Which THREE steps are necessary to create a file-based lookup?

Select 3 answers

A.Upload the lookup file to the correct directory.

B.Define a lookup definition in transforms.conf.

C.Create a lookup definition in props.conf.

D.Define an automatic lookup in props.conf.

E.Restart Splunk.

AnswersA, B, E

The file must be placed in the app's lookups directory (e.g., $SPLUNK_HOME/etc/apps/search/lookups).

Why this answer

To create a file-based lookup in Splunk, three steps are necessary: upload the lookup file to the correct lookups directory (A), define a lookup definition in transforms.conf (B), and restart Splunk to apply the changes (E). The lookup definition maps the file to a lookup table name. Props.conf is not used for defining lookups; it is for field extractions and event processing.

Restarting Splunk is required because changes to transforms.conf take effect only after a restart. Automatic lookups (D) are optional and defined separately if needed.

Full explanation →

160

MCQeasy

A Splunk admin wants to create a macro named `filter_by_app` that accepts an application name as an argument and returns a search string filtering by that application. The application name may contain spaces. Which of the following correctly defines the macro's arguments and usage?

A.Definition: `filter_by_app(1)` and usage: `index=main app=$1$`

B.Definition: `filter_by_app($app$)` and usage: `index=main app=$app$`

C.Definition: `filter_by_app($app$)` and usage: `index=main app="$app$"`

D.Definition: `filter_by_app(app)` and usage: `index=main app=app`

E.Definition: `filter_by_app($1)` and usage: `index=main app=$1`

AnswerC

Definition uses $app$ as argument placeholder and usage uses $app$ with quotes, correctly handling spaces.

Why this answer

Macro arguments must be referenced with $arg$ syntax and when the value contains spaces, it must be quoted. Option A defines the argument numerically (1) and uses $1$ without quotes, which fails for spaces. Option B defines the argument with $app$ (invalid syntax for definition) and uses $app$ without quotes.

Option D defines 'app' without dollar signs, so the usage treats 'app' as literal text, not a variable. Option E uses $1 without a trailing dollar sign, which is invalid.

Full explanation →

161

MCQeasy

Which of the following is true about the sort command?

A.All of the above

B.It only sorts in ascending order by default

C.It can sort by multiple fields

D.It can use the limit parameter to limit results

AnswerA

All statements are correct.

Why this answer

The sort command in Splunk can sort in ascending order by default, can sort by multiple fields, and can use the limit parameter to restrict the number of results. All three statements (B, C, and D) are true, making 'All of the above' the correct choice.

Exam trap

The trap here is that candidates may assume only one of B, C, or D is true, but the question is designed to test whether you recognize that all three statements are accurate, leading to 'All of the above' as the correct answer.

How to eliminate wrong answers

Option B is not wrong because it is true: the sort command sorts in ascending order by default unless the '-' prefix is used to specify descending order. Option C is not wrong because it is true: you can sort by multiple fields by listing them separated by commas, e.g., `sort field1, field2`. Option D is not wrong because it is true: the limit parameter (e.g., `sort limit=10 field`) restricts the output to the top N results based on the sort order.

Full explanation →

162

MCQeasy

A Splunk admin is tasked with creating a set of macros that will be used by multiple app developers to standardize searches across the organization. The macros need to accept parameters such as index, sourcetype, and time range. Some macros will be complex and include subsearches. Which approach should the admin take to ensure maximum reusability and maintainability?

A.Create separate macros for each combination of parameters.

B.Embed all logic into a single macro and use conditional statements.

C.Use macro arguments with default values and include comments in the definition.

D.Define macros with no arguments and rely on the developers to modify the macro code.

AnswerC

Correct: Arguments with defaults allow flexible use, and comments improve maintainability.

Why this answer

Using macro arguments with default values and comments provides flexibility and clarity. Defining macros without arguments forces users to edit for each use. Separate macros for each parameter combination create unnecessary duplication.

A single macro with conditionals becomes complex and hard to maintain.

Full explanation →

163

MCQhard

Refer to the exhibit. The lookup 'lookup_user_info' is used in a search: `| lookup lookup_user_info user_id OUTPUT department`. Users report that many events show 'UNKNOWN' as department even though the user_id exists in the CSV. What is the most likely cause?

A.The lookup file is not distributed to all indexers.

B.The field name in the CSV header is 'User_ID' (capital U), while the event field is 'user_id' (lowercase). Splunk field matching is case-sensitive.

C.The match_type is not specified, defaulting to EXACT, but the CSV contains case variations.

D.The max_matches should be set to 0.

E.The lookup definition is missing the default_match setting, which should be set to 'no_match'.

AnswerB

Splunk field names are case-sensitive; the mismatch causes no match, returning the default 'UNKNOWN'.

Why this answer

Splunk lookups are case-sensitive when matching field values. The exhibit shows the CSV header uses 'User_ID' (capital U), while the search references 'user_id' (lowercase). Since the lookup field name in the definition must exactly match the event field name, the mismatch causes the lookup to fail, returning 'UNKNOWN' for all events even when the user_id exists in the CSV.

Exam trap

The trap here is that candidates often assume Splunk field matching is case-insensitive, but Splunk treats field names in lookups as case-sensitive, leading to silent failures when the CSV header case does not match the event field case.

How to eliminate wrong answers

Option A is wrong because the lookup file is used in a search that runs on the search head; it does not need to be distributed to indexers unless it is used in an index-time lookup or a distributed lookup scenario, which is not indicated. Option C is wrong because the default match_type is EXACT, but the issue is a field name mismatch (case sensitivity of the field name itself), not case variations in the data values. Option D is wrong because max_matches controls how many matching rows to return per event; setting it to 0 would return no matches, but the core problem is that no match is found due to field name mismatch, not the number of matches.

Option E is wrong because the default_match setting controls what value to output when no match is found; while it could be set to 'no_match', the root cause is the field name mismatch, not the absence of this setting.

Full explanation →

164

MCQeasy

A Splunk admin wants to create a macro that extracts the username from a log line that always starts with 'User: <username>'. The macro should be reusable across searches. Which definition is correct?

A.`rex field=_raw "User: (?<username>\S+)"`

B.`eval username=extract("User: (?<username>\S+)")`

C.`rex field=_raw "User: (?<username>\S+)" | eval username=$result$`

D.`username = rex field=_raw "User: (?<username>\S+)"`

AnswerA

This is a valid macro definition for extraction.

Why this answer

The `rex` command with `field=_raw` and a named capturing group `(?<username>\S+)` extracts the username into a field called `username`. This is the standard Splunk way to perform regex extraction in a search, and wrapping it in a macro makes it reusable across searches without additional syntax.

Exam trap

Splunk often tests the distinction between `rex` (a transforming command) and `eval` (a non-transforming command), and candidates mistakenly try to use `eval` with regex functions that do not exist in Splunk.

How to eliminate wrong answers

Option B is wrong because `extract()` is not a valid Splunk eval function; regex extraction must use `rex` or `replace` with `rex` mode, not `eval`. Option C is wrong because `$result$` is not a valid token in this context; `rex` directly populates the named field, and piping to `eval` with `$result$` is unnecessary and incorrect. Option D is wrong because `username = rex ...` is not valid SPL syntax; `rex` is a standalone command, not an assignment within an eval expression.

Full explanation →

165

Multi-Selecthard

A security analyst is using a lookup table to enrich IP addresses with threat intelligence. Which THREE statements about lookups are true?

Select 3 answers

A.Lookups can be used to add fields from an external source

B.Lookups can only be used with exact match

C.Lookups require the data to be indexed in Splunk

D.A lookup can be configured as automatic in props.conf

E.Lookups can be based on CSV files or KV store

AnswersA, D, E

That is the primary purpose of lookups: enrichment.

Why this answer

Lookups can be automatic via props.conf, can be based on CSV or KV Store, and are used to add fields from an external source. They are not limited to exact match (range lookups exist) and do not require data to be indexed in Splunk.

Full explanation →

166

Multi-Selectmedium

Which ONE setting is required in a transforms.conf stanza for a file-based lookup to work? (Select one.)

Select 1 answer

A.max_matches

B.match_type

C.case_sensitive_match

D.filename

E.default_match

AnswersD

filename is required to specify the lookup file.

Why this answer

In Splunk transforms.conf, only the 'filename' setting is mandatory for a file-based lookup. The 'match_type' setting is optional and defaults to 'EXACT' if not specified. Therefore, only D is correct.

Full explanation →

167

Multi-Selectmedium

A Splunk search uses 'transaction' to correlate events. The transaction times out before all expected events are added. Which TWO options can be adjusted to allow more time for transaction completion? (Choose two.)

Select 2 answers

A.Increase 'maxopentxn'.

B.Set 'connected=false'.

C.Increase 'maxevents'.

D.Decrease 'maxspan'.

E.Increase 'maxtime' in the transaction command.

AnswersC, E

Correct: Allows more events per transaction.

Why this answer

Options C and E are correct. 'maxevents' sets the maximum number of events per transaction; increasing it allows more events to be collected before the transaction times out. 'maxtime' sets the maximum time (in seconds) from the first event to the transaction completion; increasing it gives the transaction more time to complete. Option A ('maxopentxn') controls the maximum number of concurrent open transactions, not the timeout. Option B ('connected=false') changes event grouping behavior and does not extend time.

Option D ('maxspan') defines the maximum time span between earliest and latest event in a transaction; decreasing it would shorten the window and likely cause more timeouts.

Full explanation →

168

Multi-Selecteasy

Which TWO of the following are valid uses of the Common Information Model (CIM) in Splunk?

Select 2 answers

A.Defining user roles and permissions for data access.

B.Managing license usage across indexers.

C.Creating new indexes for faster search performance.

D.Defining tags and event types to categorize data.

E.Normalizing data from different sources to a common field naming convention.

AnswersD, E

CIM uses tags and event types to map data to models.

Why this answer

The CIM provides a standardized set of tags and event types that allow you to categorize and classify data from diverse sources, enabling consistent searching and correlation across your Splunk environment. Option E is correct because the CIM defines common field names (e.g., src_ip, dest_ip, user) to normalize data from different technologies, ensuring that searches and dashboards work uniformly regardless of the original data source.

Exam trap

The trap here is that candidates often confuse the CIM with operational or administrative features (like roles, licensing, or index management) because they are all part of Splunk's ecosystem, but the CIM is strictly a semantic layer for data normalization and categorization.

Full explanation →

169

MCQeasy

Which command creates a new field that contains the string 'high' if a numeric field exceeds 100, otherwise 'low'?

A.eval status=if(value>100,"high","low")

B.eval status=case(value>100,"high",true(),"low")

C.eval status=if(value>100,high,low)

D.None of the above

AnswerA

Correct syntax with quoted strings.

Why this answer

The `eval` command with the `if` function correctly checks if the numeric field `value` exceeds 100 and returns the string 'high' or 'low'. In Splunk's `eval`, the `if` function requires the true and false results to be quoted strings when they are literal text, as shown in option A.

Exam trap

Splunk often tests the requirement to quote string literals in `eval` expressions, and the trap here is that candidates may forget to quote the string values 'high' and 'low', treating them as field names instead of literal strings.

How to eliminate wrong answers

Option B is wrong because the `case` function syntax is incorrect: the condition `value>100` is followed by `"high"`, but the default case uses `true()` without a corresponding result string; the correct syntax would be `case(value>100,"high",1=1,"low")` or similar. Option C is wrong because the `if` function's true and false results are unquoted (`high` and `low`), which Splunk interprets as field names or variable references, not literal strings, leading to errors or unexpected behavior. Option D is wrong because option A is correct.

Full explanation →

170

MCQeasy

An analyst runs this search and gets no results. The lookup file server_list.csv exists and contains data. What is the most likely issue?

A.The lookup file is not in the correct lookup directory.

B.The field names in the CSV do not match the search fields.

C.The search should include an index specification.

D.The search should use 'lookup' instead of 'inputlookup'.

AnswerB

If the CSV has different field names, the search conditions won't match, resulting in zero results.

Why this answer

The search likely uses fields (e.g., status, hostname, ip_address) that do not match the column headers in server_list.csv. The inputlookup command returns results only if field names align; a mismatch leads to no output. Other options are less likely: the file exists so it is in the correct directory (A); index specification is irrelevant for lookups (C); inputlookup is appropriate for inline lookups (D).

Full explanation →

171

Multi-Selecteasy

Which TWO of the following are valid ways to define arguments in a Splunk macro?

Select 2 answers

A.In the macro definition, use $arg1$, $arg2$ as placeholders for the arguments.

B.Arguments are defined by listing them in the 'args' attribute in macros.conf.

C.In the macro definition, use $1$, $2$ as positional placeholders.

D.Arguments are automatically inferred from the search string in the macro definition.

E.In the macro definition, use named placeholders like $error_code$.

AnswersA, B

Correct. $arg1$, $arg2$ are the standard positional placeholders.

Why this answer

Splunk macros use named placeholders like $arg1$, $arg2$ in the macro definition to represent arguments. When the macro is invoked, these placeholders are replaced with the actual values passed by the user, allowing flexible and reusable search snippets.

Exam trap

Splunk often tests the distinction between named placeholders ($arg1$) and positional placeholders ($1$), leading candidates to mistakenly think positional placeholders are valid in Splunk macros when they are not.

Full explanation →

172

MCQhard

An analyst runs this search and gets a chart with only the top 5 hosts per time bucket, but the total count per bucket is much higher than the displayed counts. What is the issue?

A.The chart is missing a 'useother=t' option to aggregate the remainder into an 'Other' bucket.

B.The limit parameter is misused; it should be 'limit=0' to show all hosts.

C.The timechart command automatically uses 'other' for the remaining hosts.

D.The limit parameter applies to the entire search, not per bucket.

E.The limit parameter restricts the number of series per bucket, but not the overall count aggregation.

AnswerA

Adding useother=t groups remaining hosts into 'Other' to account for total count.

Why this answer

The timechart command, by default, limits the number of series per time bucket (default 10). Without useother=t, any hosts beyond the top N are discarded, not aggregated. This explains why the total count per bucket is higher than the displayed counts.

Using useother=t adds an "Other" bucket that sums the counts for all remaining hosts, so the total per bucket matches the overall count. Option B is incorrect: limit=0 would show all hosts but is not necessary; the issue is aggregation, not limiting. Option C is incorrect: timechart does not automatically create an "Other" bucket.

Option D is incorrect: the limit parameter applies per time bucket, not the entire search. Option E is incorrect: while true that limit restricts series per bucket, that restriction causes the mismatch; the fix is to use useother=t to aggregate.

Full explanation →

173

MCQhard

A web application log contains fields: user, timestamp, response_time. You need to compute the average response time per user, excluding outliers where response_time > 10000ms. Which search produces the correct result?

A.index=web | stats avg(response_time) as avg by user | eval avg = if(avg > 10000, null, avg)

B.index=web | stats avg(response_time) by user | where response_time < 10000

C.index=web | eventstats avg(response_time) as overall_avg | where response_time < 10000 | stats avg(response_time) by user

D.index=web | where response_time < 10000 | stats avg(response_time) by user

AnswerD

Filters outliers first, then computes average per user.

Why this answer

It first filters out outliers (response_time < 10000) using the where command, then calculates the average response time per user with stats avg(response_time) by user. This ensures outliers are excluded before the average is computed. Option A is incorrect because it uses if() after stats, which incorrectly modifies the average after it includes outliers.

Option B is incorrect because the where clause after stats erroneously filters based on the per-user average itself, not on individual response_time values. Option C is incorrect because eventstats computes an overall average that still includes outliers, and the subsequent filter does not retroactively affect that average.

Full explanation →

174

Multi-Selectmedium

An administrator is designing a dashboard with multiple panels that share a common time picker. Which THREE dashboard features can be used to synchronize time across panels?

Select 3 answers

A.Use the 'link time' option in dashboard editor

B.Use the $time_token$ variable in panel searches

C.Use a single time input with a token

D.Set each panel's time range independently

E.Use the 'earliest' and 'latest' fields with a shared token

AnswersB, C, E

Referencing the token ensures panels share the same time.

Why this answer

Using a single time input with a token, referencing the token in panel searches, and using earliest/latest fields with the token are standard methods. Setting each panel independently does not synchronize, and 'link time' is not a standard feature.

Full explanation →

175

Multi-Selectmedium

A Splunk user wants to create a stacked bar chart showing the count of events by status (success, failure) over time. Which TWO configuration steps are necessary?

Select 2 answers

A.Use the timechart command with a split-by field

B.Use the eval command to create a new field

C.Use the chart command with a split-by field

D.Select the 'line' chart type

E.Set the stack mode to 'stacked' in visualization options

AnswersA, E

timechart count by status produces time-series data with separate series.

Why this answer

To create a stacked bar chart over time, you need to use timechart with a split-by field to get time series and then set the stack mode to stacked in visualization options. Chart command does not inherently produce time series, and eval is not needed. Line chart is not stacked bar.

Full explanation →

176

MCQhard

A developer needs to calculate the 95th percentile of response times for each service over the past hour. The data has fields: service, response_time. Which search achieves this correctly and efficiently?

A.`index=main | stats perc95(response_time) by service`

B.`index=main | timechart perc95(response_time) by service`

C.`index=main | eventstats perc95(response_time) as p95 by service | stats values(p95) as p95 by service`

D.`index=main | streamstats perc95(response_time) as p95 by service | stats latest(p95) as p95 by service`

AnswerA

Correct. This search uses `stats` with a `by` clause to compute the 95th percentile for each service directly from all events in the result set. It is the most straightforward and efficient method.

Why this answer

`stats perc95(response_time) by service` directly calculates the 95th percentile for each service across all events in one efficient pass. It is the simplest and most efficient way. Option C, while producing the same result, is less efficient because it first appends the percentile to every event using `eventstats` and then collapses with `stats values()`, adding unnecessary overhead.

Option B uses time-based bucketing and option D uses a running calculation, both of which do not produce the desired overall percentile.

Exam trap

Splunk often tests the distinction between `eventstats` (global aggregation appended to events) and `streamstats` (running aggregation per event), and candidates mistakenly choose `streamstats` thinking it computes a final percentile, when it actually produces a cumulative value that changes with each event.

How to eliminate wrong answers

Option A is wrong because `stats perc95(response_time) by service` is not valid syntax; the correct function is `perc95(response_time)` or `exactperc95(response_time)`, and `perc95` is not a recognized stats function in Splunk. Option B is wrong because `timechart` automatically splits the data into time buckets (e.g., 1-minute spans), which would calculate the 95th percentile per time slice rather than over the entire past hour, producing incorrect results for the requirement. Option D is wrong because `streamstats` computes a running (cumulative) percentile as each event is processed, not the overall percentile for the entire hour, and `latest(p95)` would only capture the final running value, which is not the same as the global 95th percentile.

Full explanation →

177

MCQeasy

Which of the following is required to create a dynamic lookup that automatically updates from a CSV file?

A.Define the lookup in transforms.conf and props.conf

B.Use the lookup command in searches

C.Upload the CSV to the lookups folder only

D.Only define in transforms.conf

AnswerA

Both files are needed: transforms.conf defines the lookup, props.conf associates it with a source type for automatic application.

Why this answer

To create a dynamic lookup that automatically updates from a CSV file, you must define the lookup in both transforms.conf and props.conf. The transforms.conf defines the lookup table and its source file, while props.conf enables automatic lookup and associates it with the appropriate sourcetype. Simply uploading the CSV or defining only in transforms.conf is insufficient; using the lookup command in searches is not required for the automatic update mechanism.

Full explanation →

178

MCQmedium

A dashboard is slow to load because it runs a search that uses `transaction` to group events into sessions. The search is `index=main source=web | transaction clientip maxspan=30m maxpause=5m`. What is the most effective way to improve performance?

A.Add `| head 1000` before the `transaction` command

B.Replace `transaction` with `stats dc(_time) as session_duration by clientip` and use `bin`

C.Set `maxspan=1h` and `maxpause=1m`

D.Add `| eval session_id=random()` before transaction

AnswerB

`stats` is more efficient and can approximate sessions.

Why this answer

Replacing `transaction` with `stats` and `bin` avoids the expensive event grouping and stateful processing that `transaction` requires. The `transaction` command must hold events in memory to correlate them by `clientip` within time windows, which is slow on large datasets. Using `stats dc(_time)` with `bin` computes session metrics more efficiently by aggregating over time buckets without tracking individual event sequences.

Exam trap

Splunk often tests the misconception that `transaction` is the only way to group events into sessions, when in fact `stats` with `bin` or `eventstats` can achieve similar results with far better performance.

How to eliminate wrong answers

Option A is wrong because adding `| head 1000` before `transaction` would discard most events, producing incomplete and misleading session data, and does not address the root cause of slow performance. Option C is wrong because tightening `maxspan` and `maxpause` may reduce the number of events grouped per session but does not eliminate the fundamental overhead of the `transaction` command's stateful processing. Option D is wrong because `| eval session_id=random()` before `transaction` adds a random field that has no correlation with actual sessions, and `transaction` would still need to process all events with the same overhead.

Full explanation →

179

Multi-Selecteasy

A search is running slowly due to a large data volume. Which TWO modifications are likely to improve search performance? (Select two.)

Select 2 answers

A.Use wildcard characters at the beginning of search terms.

B.Use the transaction command to group events.

C.Reduce the time range of the search.

D.Use the dedup command as early as possible.

E.Use indexed fields instead of search-time extracted fields.

AnswersC, E

Limits data volume scanned

Why this answer

Reducing the time range limits the volume of data scanned by the search head, directly reducing I/O and processing overhead. This is one of the most effective ways to improve search performance because Splunk must read and filter every event in the specified time window from the index.

Exam trap

Splunk often tests the misconception that using the transaction or dedup command early in a search improves performance, when in fact these commands are memory-intensive and should be deferred until after data volume is reduced.

Full explanation →

180

MCQeasy

A team wants to visualize sales data on a map. They have a lookup table containing city names and their latitude/longitude coordinates. Which visualization type should they use in Splunk to plot the sales amounts on a map?

A.Single value

B.Gauge

C.Choropleth map

D.Scatter plot

AnswerC

Choropleth maps color regions based on values.

Why this answer

C is correct because a choropleth map uses geographic boundaries (e.g., countries, states, or cities) and shades or colors them based on a numeric value, such as sales amounts. With a lookup table providing latitude/longitude coordinates, Splunk can geocode the city names and overlay the sales data on a map using the `geostats` command, which is designed for choropleth visualizations.

Exam trap

The trap here is that candidates often confuse a scatter plot (which can plot lat/lon as x/y coordinates) with a choropleth map, but Splunk's scatter plot does not support geographic boundary shading or the `geostats` command required for map-based aggregation.

How to eliminate wrong answers

Option A is wrong because a single value visualization displays one metric (e.g., total sales) as a large number or gauge, not a geographic map. Option B is wrong because a gauge shows a single numeric value within a range (e.g., a speedometer-style dial) and cannot plot multiple data points across locations. Option D is wrong because a scatter plot plots individual points on an x-y axis based on two numeric fields, not geographic coordinates; while it could theoretically use lat/lon as axes, it lacks the boundary-based shading and geographic context of a choropleth map.

Full explanation →

181

MCQhard

A large e-commerce company has a Splunk environment ingesting web server logs from multiple data centers. The security team needs to visualize failed login attempts over time, grouped by geographic region. They have a lookup file geo_region.csv that maps IP addresses to regions. The lookup is defined in transforms.conf with max_matches=0 (all matches) and is used as an automatic lookup in props.conf for the sourcetype 'web_access'. The search returns events with multiple region values per IP (because max_matches=0). The team wants a single region per event for accurate counting. They also need to reduce the number of events processed by filtering only login failures (status=401). Which approach should be taken?

A.Use | where status=401 | dedup src_ip | timechart count by region

B.Modify the automatic lookup to use max_matches=1, and add | where status=401 to the search before the timechart

C.Use | where status=401 | mvexpand region | timechart count by region

D.Use | where status=401 | top limit=100 region

AnswerB

Filters early and ensures one region per event.

Why this answer

Modifying the automatic lookup to use max_matches=1 ensures that each event is assigned a single region, eliminating the need for deduplication or expansion. Adding the `| where status=401` filter before the timechart reduces the dataset to only failed login attempts, allowing accurate counting by region over time. This approach is efficient and directly addresses the requirement for a single region per event.

Exam trap

The trap here is that candidates may think `mvexpand` or `dedup` can fix the multivalue region issue, but they fail to realize that these commands either inflate counts or discard valid data, whereas adjusting the lookup configuration is the proper solution.

How to eliminate wrong answers

Option A is wrong because `dedup src_ip` removes duplicate source IPs but does not resolve the multiple region values per event; it may also incorrectly discard legitimate events from the same IP with different timestamps or regions. Option C is wrong because `mvexpand region` creates multiple events from a single event (one per region), which inflates the count of failed logins and produces inaccurate results. Option D is wrong because `top limit=100 region` only shows the top 100 regions by count, not a time-based visualization, and does not filter to a single region per event.

Full explanation →

182

MCQmedium

Refer to the exhibit. The search is intended to display users who logged in from IP addresses starting with 10.0, but returns no results. What is the most likely cause?

A.The regex pattern is incorrect.

B.The field 'ip' is not extracted properly.

C.The `search` command should be `where` to use wildcard on extracted fields.

D.The index should be specified at the beginning of the search.

AnswerC

For extracted (non-indexed) fields, `search` may not support wildcards efficiently; `where` with `like` is appropriate.

Why this answer

The search uses `search ip=10.0*` which attempts to apply a wildcard pattern to an extracted field. However, the `search` command does not support wildcards for field-value comparisons; it treats `10.0*` as a literal string. To use wildcards on extracted fields, the `where` command with a `like` operator (e.g., `where ip like "10.0%"`) or a regex match is required.

This is why option C is correct.

Exam trap

Splunk often tests the misconception that the `search` command supports wildcards for extracted fields, leading candidates to overlook the need for `where` or `regex` commands for pattern matching on field values.

How to eliminate wrong answers

Option A is wrong because the regex pattern is not the issue; the search does not use a regex command at all, and the problem lies in the `search` command's inability to interpret wildcards on field values. Option B is wrong because the field 'ip' is likely extracted properly (otherwise the search would not run without errors), but the wildcard matching fails due to command semantics. Option D is wrong because specifying the index at the beginning is a best practice for performance but is not required for the search to return results; the absence of an index does not cause zero results when the data is already in the default index.

Full explanation →

183

MCQhard

Refer to the exhibit. The search is taking very long and returning few results. Which change would most improve performance?

A.Change maxpause to 30s.

B.Remove the eval command.

C.Replace transaction with stats and use values() for fields.

D.Add a time range to the main search.

AnswerD

Limiting the time range reduces the amount of data processed, improving performance.

Why this answer

The exhibit shows a transaction command that groups events by a session field, but without a time range, the search must scan all indexed data, which is extremely slow. Adding a time range (e.g., earliest=-1h) limits the data scanned, drastically improving performance while still allowing the transaction to complete within the default maxpause of 5s.

Exam trap

The trap here is that candidates focus on tuning the transaction parameters (maxpause) or replacing the command, rather than recognizing that the fundamental performance bottleneck is the absence of a time range filter in the base search.

How to eliminate wrong answers

Option A is wrong because increasing maxpause to 30s would make the transaction wait longer for late events, potentially increasing search time and resource usage, not improving performance. Option B is wrong because removing the eval command (which likely creates the session field used by transaction) would break the grouping logic, making the search return incorrect or no results. Option C is wrong because replacing transaction with stats and values() might reduce memory overhead but would not address the root cause of scanning all time; without a time range, stats would still scan the entire index, and the search would remain slow.

Full explanation →

184

Multi-Selecteasy

Which of the following are valid ways to define a macro in Splunk? (Choose two.)

Select 2 answers

A.Using the `macro` command in a saved search

B.Using the `| macro` command in a search

C.Using named arguments like $field$ in the definition, with the argument names defined in the macro properties

D.Using the `define` command in the search bar

E.Using positional arguments like $1$ in the definition

AnswersC, E

Correct: Named arguments require definition in properties.

Why this answer

Options C and E are correct ways to define a macro in Splunk. Macros can use named arguments (e.g., $field$) with argument names defined in the macro properties, or positional arguments (e.g., $1$, $2$) that are referenced by position. Option A is incorrect because the `macro` command does not exist; macros are defined in Settings > Advanced Search > Search Macros.

Option B is incorrect because there is no `| macro` search command. Option D is incorrect because there is no `define` command for macros; macros are defined in the knowledge object settings.

Full explanation →

185

MCQmedium

Which command is best for calculating a running total of sales per customer across events without creating a multivalued field?

A.streamstats

B.stats

C.transaction

D.eventstats

AnswerA

streamstats computes windowed functions like running total per group.

Why this answer

(streamstats) is correct because it calculates a running total per customer across events without creating multivalued fields. Option B (stats) aggregates all events into a single result per group, not a running total. Option C (transaction) groups related events but does not compute running totals.

Option D (eventstats) adds aggregate values to each event but not a per-row progression.

Full explanation →

186

MCQhard

A Splunk admin creates a macro named `lookup_user` that is defined as `| lookup user_lookup user AS $1$ OUTPUT full_name as user_name`. The macro is used in a search like `index=main | `lookup_user(user_id)`. However, the results show no matches even though valid user_id values exist. What is the most likely cause?

A.The macro is missing a closing parenthesis

B.The lookup file does not have a field named `user`

C.The lookup command should be `inputlookup` instead of `lookup`

D.The macro definition incorrectly includes a leading pipe

AnswerD

Correct: Double pipe causes the lookup to fail.

Why this answer

Because the macro is invoked with a pipe (`| `lookup_user...), the definition should not include a leading pipe. If it does, the expanded search becomes `| | lookup...`, which causes a syntax error or unexpected behavior. Option A could be possible but less likely; if the lookup file lacks the field `user`, the lookup would fail silently.

Option B not likely. Option C inputlookup is for static lookups.

Full explanation →

187

MCQhard

A search returns 50,000 events. The analyst wants to sample 1% evenly across time. Which sampling command should be used?

A.sample 0.01

B.sample method=random ratio=0.01

C.sample method=block ratio=0.01

D.sample ratio=0.01

AnswerB

This performs random sampling with a 1% ratio, distributing events evenly across time.

Why this answer

The `sample` command with `method=random` and `ratio=0.01` performs a random sampling of exactly 1% of events, and when used without a `by` clause, it distributes the sampling evenly across time by default. This ensures a statistically representative subset of the 50,000 events, preserving temporal distribution.

Exam trap

The trap here is that candidates often assume `sample` defaults to random sampling, but it actually defaults to `method=block`, so omitting the `method=random` parameter (as in option D) would not achieve the required even distribution across time.

How to eliminate wrong answers

Option A is wrong because `sample 0.01` is invalid syntax; the `sample` command requires the `ratio` argument to be explicitly named (e.g., `ratio=0.01`) and does not accept a bare number. Option C is wrong because `method=block` samples contiguous blocks of events, which would not distribute evenly across time and could cluster events from a specific time period, violating the requirement for even temporal distribution. Option D is wrong because `sample ratio=0.01` defaults to `method=block`, not `method=random`, so it would produce block sampling rather than the random sampling needed for even distribution across time.

Full explanation →

188

MCQhard

A large e-commerce platform uses Splunk to monitor user sessions. Each session is composed of multiple events with a common 'session_id' field. The current search to compute average session duration is: 'index=web | transaction session_id maxspan=30m | eval duration=_time_last - _time | stats avg(duration)'. This search runs for over an hour on a 6-hour time window. The environment has 20 indexers and data volume is 2 TB/day. The admin suspects that the transaction command is the bottleneck. Which optimization should be applied?

A.Reduce the time range to 1 hour.

B.Add 'eventstats earliest(_time) as start latest(_time) as end by session_id' before transaction.

C.Replace transaction with 'stats earliest(_time) as start latest(_time) as end by session_id | eval duration=end-start | stats avg(duration)'.

D.Remove the maxspan parameter from the transaction command to allow longer sessions.

AnswerC

Much more efficient because stats uses less memory than transaction.

Why this answer

The correct optimization is Option C: replacing the transaction command with 'stats earliest(_time) as start latest(_time) as end by session_id | eval duration=end-start | stats avg(duration)'. The transaction command is inefficient because it groups all session events in memory and calculates duration, which consumes significant resources on 20 indexers with 2 TB/day. The stats approach is streaming and reduces data to one row per session before the eval and avg, drastically lowering memory and CPU usage.

Option A (reducing time range to 1 hour) might help but doesn't address the core inefficiency and could miss sessions spanning longer than an hour. Option B (adding eventstats before transaction) adds extra processing without removing the bottleneck, still using transaction. Option D (removing maxspan) would allow sessions to remain open indefinitely, increasing memory consumption and potentially causing timeouts.

Therefore, Option C is the most effective optimization.

Full explanation →

189

MCQmedium

A company wants to correlate events from multiple sources that share a common transaction ID. The events arrive in real time but with variable delays. Which transaction option ensures that a transaction closes after 2 minutes of inactivity?

A.endswith="end"

B.maxspan=2m

C.maxpause=2m

D.startswith="start"

AnswerC

maxpause closes transaction if no matching event arrives within 2 minutes.

Why this answer

Maxpause=2m (Option C). This option specifies the maximum period of inactivity between events in a transaction. When no events matching the transaction are received for 2 minutes, the transaction closes.

This is ideal for correlating events with variable delays because it waits for activity and closes after a quiet period. In contrast, maxspan (option B) sets a total time window from the first event, which would close the transaction regardless of activity after 2 minutes from the start. Options A and D (startswith/endswith) define specific start and end events rather than a timeout.

Thus, maxpause ensures the transaction remains open as long as events arrive within 2 minutes of each other.

Full explanation →

190

MCQhard

A Splunk administrator is troubleshooting a search that uses the transaction command to group login and logout events. The search runs but returns no results even though both types of events exist. The events are separated by at most 5 minutes. The current transaction command is: `index=auth (action=login OR action=logout) | transaction action maxspan=10m maxpause=2s` What is the most likely cause?

A.The maxspan value is too large, causing events to be grouped incorrectly.

B.The transaction command requires the connected=true argument to group events.

C.The transaction command requires keepevents=true to retain all events.

D.The maxpause value is too small; events may be more than 2 seconds apart.

AnswerD

maxpause sets the maximum time between events in a transaction; 2 seconds may be too restrictive.

Why this answer

The maxpause=2s parameter defines the maximum allowed gap between consecutive events in a transaction. If the actual time between a login and its corresponding logout event exceeds 2 seconds, the transaction command will close the transaction prematurely, treating the logout as the start of a new transaction. Since the events are separated by at most 5 minutes but could be more than 2 seconds apart, the maxpause value is too restrictive, causing the transaction to never complete with both events.

Exam trap

Splunk often tests the distinction between maxspan (total transaction duration) and maxpause (gap between events), leading candidates to incorrectly assume that a large maxspan is the problem when the real issue is an overly restrictive maxpause.

How to eliminate wrong answers

Option A is wrong because a maxspan of 10 minutes is appropriate for events separated by at most 5 minutes; a larger maxspan does not cause grouping errors—it simply allows a wider window. Option B is wrong because the connected=true argument is used for subsearches or to enforce field-based connections, not for the basic transaction command which groups by the specified field (action) by default. Option C is wrong because keepevents=true is used to retain all raw events in the transaction output for inspection, but its absence does not prevent the transaction from forming; it only affects whether individual events are preserved in the results.

Full explanation →

191

MCQhard

A Splunk admin notices that a saved search scheduled to run every 10 minutes is consistently taking 15 minutes to complete, causing overlapping runs. The search aggregates data across multiple indexes and uses a large time window. What is the best way to prevent overlap and ensure the search completes?

A.Set the search to 'Run on a timer' and increase the schedule interval to 20 minutes.

B.Enable the 'Schedule Priority' setting to 'Higher' and set 'Schedule Window' to 0.

C.Reduce the search time window to 5 minutes to decrease execution time.

D.Configure the search to 'Skip the next scheduled run if the previous run is still in progress'.

AnswerD

This prevents overlapping runs by skipping if still running.

Why this answer

The 'Skip the next scheduled run if the previous run is still in progress' setting is specifically designed to prevent overlapping executions of a saved search. This ensures that if a search takes longer than its scheduled interval, the next scheduled run is skipped, avoiding resource contention and incomplete results.

Exam trap

The trap here is that candidates often confuse increasing the schedule interval or reducing the time window as a solution, but the correct approach is to use the built-in overlap prevention setting, which directly addresses the problem of overlapping runs without altering the search logic or data coverage.

How to eliminate wrong answers

Option A is wrong because simply increasing the schedule interval to 20 minutes does not guarantee the search will complete within that time; it only reduces the frequency of runs, but the search could still overlap if execution time varies. Option B is wrong because 'Schedule Priority' and 'Schedule Window' control when the search runs relative to other scheduled searches, not whether overlapping runs are prevented; setting 'Schedule Window' to 0 forces immediate execution but does not handle overlap. Option C is wrong because reducing the search time window to 5 minutes may not capture the required data and does not address the root cause of the search taking longer than the interval; it could also lead to incomplete or inaccurate results.

Full explanation →

192

MCQmedium

A Splunk administrator needs to schedule a saved search to run every second Friday at 10:00 AM. Which cron expression should be used?

A.0 10 * * 5

B.0 10 8-14 * 5

C.0 10 */2 * *

D.0 10 * * *

AnswerB

This runs at 10:00 AM on Fridays that fall between the 8th and 14th of the month, which covers the second Friday.

Why this answer

The correct cron expression for every second Friday at 10:00 AM is '0 10 8-14 * 5'. This expression runs at 10:00 AM on Fridays (day 5) only if the day of month is between 8 and 14, which includes the second Friday. Option A ('0 10 * * 5') runs every Friday at 10:00 AM, not just the second one.

Option C ('0 10 */2 * *') runs at 10:00 AM every other day (every 2 days) regardless of day of week. Option D ('0 10 * * *') runs at 10:00 AM every day. Therefore, B is correct.

Full explanation →

193

MCQmedium

The following search is executed: index=web | rex "GET (?<url>.*)" | eval category=case(url="/api/v1/data","API", url="/login","Login",1=1,"Other") | stats count by category But it returns unexpected results: the count for 'API' is much lower than expected. What is the most likely cause?

A.The stats command should use 'count by category' but category is not a field until after eval.

B.The regex does not account for the HTTP version string after the URL, causing the URL field to include extra characters like 'HTTP/1.1'.

C.The case function has a default condition '1==1' that overrides all other conditions.

AnswerB

Correct. The regex does not account for the HTTP version string after the URL, causing the URL field to include extra characters like 'HTTP/1.1'. This leads to mismatched patterns in the eval and stats commands.

Why this answer

The most likely cause is that the regex pattern used to extract the URL does not account for the HTTP version string that often appears after the URL, such as 'HTTP/1.1'. This causes the captured URL field to include extra characters like 'HTTP/1.1', which then fails to match the expected patterns in the subsequent eval and stats commands. Option A is incorrect because 'category' is defined in the eval statement using the extracted fields, so it is available after the eval.

Option C is incorrect because the case function with a default condition '1==1' is valid and only acts as a catch-all; it would not override earlier conditions if they are true.

Full explanation →

194

Multi-Selecteasy

Which THREE of the following are valid methods to create a lookup table in Splunk?

Select 3 answers

A.Use the REST API to upload a CSV file.

B.Define a lookup in props.conf with a filename.

C.Upload a CSV file via the Lookups menu in Settings.

D.Use the 'outputlookup' command in a search.

E.Use the 'inputlookup' command to create a new file.

AnswersA, C, D

The REST API allows programmatic upload of lookup files.

Why this answer

The correct methods to create a lookup table in Splunk are: uploading a CSV via the REST API (A), uploading a CSV via the Lookups menu in Settings (C), and using the 'outputlookup' command in a search to save results as a lookup (D). Option B is incorrect because defining a lookup in props.conf only references an existing file; it does not create the lookup. Option E is incorrect because 'inputlookup' reads from a lookup, not creates one.

Full explanation →

195

Multi-Selecthard

A search administrator wants to ensure that a scheduled search runs efficiently and does not impact other users. Which TWO practices should be implemented? (Select two.)

Select 2 answers

A.Set the 'dispatch.earliest_time' and 'dispatch.latest_time' to a specific time range

B.Use the 'max_time' setting in the search command

C.Use 'collect' to index summary results

D.Enable 'auto_summarize' on the search

E.Use the 'priority' setting in savedsearches.conf

AnswersA, D

Reduces data scanned, making search faster.

Why this answer

Setting 'dispatch.earliest_time' and 'dispatch.latest_time' to a specific time range limits the data scanned by the scheduled search, reducing resource consumption and preventing it from impacting other users. Option D is correct because enabling 'auto_summarize' on the search creates pre-computed summary tables that allow the scheduled search to run against summarized data rather than raw events, drastically improving efficiency and reducing system load.

Exam trap

The trap here is that candidates often confuse 'max_time' (a command-level timeout) with controlling the search time window, or they think 'collect' improves search efficiency when it actually adds indexing overhead after the search completes.

Full explanation →

196

MCQmedium

An admin wants to create a dashboard that shows the count of errors by sourcetype over the last 7 days, with the ability to click on a sourcetype to drill down to a detailed search. Which visualization and configuration supports this?

A.Use a line chart and set the 'drilldown' to 'search' in the search command.

B.Use a bar chart and set the 'drilldown' option to 'search' in the dashboard XML.

C.Use a pie chart and set the 'drilldown' option to 'search' in the dashboard XML.

D.Use a table and set the 'link' in search string.

AnswerB

Bar charts compare counts effectively and drilldown is configured in dashboard XML.

Why this answer

A bar chart is suitable for comparing counts across sourcetypes and allows drilldown via the dashboard XML configuration. Option A is incorrect because a line chart is typically used for trends over time, not for comparing counts across categories, and drilldown is not configured via the search command but in the dashboard XML. Option C is incorrect because pie charts are less effective when there are many categories, and drilldown is not configured via the search command.

Option D is incorrect because tables do support drilldown, but the configuration described is not standard; drilldown is set in the dashboard XML, not via a 'link' in the search string.

Full explanation →

197

MCQmedium

Refer to the exhibit. The search results show a large number of hosts, but the `limit=5` only shows the top 5. The eval statement fails with an error. Why?

A.The timechart span should be smaller to avoid too many fields.

B.Eval cannot be used after timechart.

C.The eval statement must use aggregation functions.

D.The field names created by timechart are based on the host names, not `count_1`, etc.

AnswerD

timechart with limit=5 creates fields like `hostname: count`, not generic count_1.

Why this answer

The `timechart` command in Splunk dynamically creates field names based on the values of the split-by field (in this case, `host`). When you use `timechart count by host limit=5`, the resulting fields are named after the actual host names (e.g., `host1`, `host2`), not generic names like `count_1`. The subsequent `eval` statement fails because it references `count_1`, which does not exist as a field in the results.

Exam trap

Splunk often tests the misconception that `timechart` with a `limit` option creates generic field names like `count_1`, `count_2`, etc., when in reality it uses the actual values from the split-by field as field names.

How to eliminate wrong answers

Option A is wrong because the `span` of the timechart does not affect the number of fields created; it only controls the time bucket size. Option B is wrong because `eval` can be used after `timechart`; the error is not due to a restriction on command order but because the field name referenced in `eval` does not exist. Option C is wrong because `eval` does not require aggregation functions after `timechart`; it can perform row-by-row calculations on existing fields, but the field must exist.

Full explanation →

198

MCQmedium

Refer to the exhibit. The eval command combines two fields into one. What is a potential issue with this search?

A.The eval command may cause syntax errors.

B.Transaction does not allow eval before it.

C.The maxspan should be after the transaction command.

D.If an event has both sessionid and correlation_id, the coalesce may create a new value that does not match other events.

AnswerD

coalesce takes the first non-null; if both fields exist but differ, only one is used, potentially breaking grouping.

Why this answer

If an event has both sessionid and correlation_id, the coalesce function will use the first non-null value. However, if the two fields have different values for the same logical session, coalesce may produce a value that does not correspond to any existing field value, causing other events in the transaction to not match. Option A is false because eval syntax is fine.

Option B is false because transaction can be used after eval. Option C is false because maxspan can be placed before transaction.

Full explanation →

199

MCQhard

A security analyst needs to find all login events where the user 'jsmith' attempted to authenticate from an IP address outside the corporate subnet (10.0.0.0/8) after business hours (after 18:00). Which search correctly filters for these events?

A.index=main sourcetype=login user=jsmith | where 'date_hour' > 18 | where NOT cidrmatch("10.0.0.0/8", src_ip)

B.index=main sourcetype=login user=jsmith date_hour>18 | search NOT src_ip=10.0.0.0/8

C.index=main sourcetype=login user=jsmith date_hour>18 | where not src_ip like "10.%"

D.index=main sourcetype=login user=jsmith date_hour>18 | where src_ip!=10.0.0.0/8

AnswerA

Correctly uses `where` with `cidrmatch` and filters by hour.

Why this answer

It uses the `cidrmatch` function to properly evaluate whether the source IP falls within the 10.0.0.0/8 subnet. The `where` clause with `date_hour > 18` correctly filters for events after business hours, and the `NOT cidrmatch` ensures only IPs outside the corporate subnet are included. This approach handles CIDR notation accurately, unlike simple string or inequality comparisons.

Exam trap

The trap here is that candidates often assume simple string or inequality operators (like `!=` or `like`) can handle CIDR subnet matching, but Splunk requires the `cidrmatch` function for accurate network range evaluation.

How to eliminate wrong answers

Option B is wrong because `search NOT src_ip=10.0.0.0/8` treats the CIDR notation as a literal string, not a subnet match, so it will not correctly exclude all IPs in the 10.0.0.0/8 range. Option C is wrong because `like "10.%"` is a wildcard pattern match that only catches IPs starting with '10.' but fails to account for the full 10.0.0.0/8 subnet (e.g., 10.0.0.0/8 includes 10.0.0.0 through 10.255.255.255, but '10.%' may miss IPs with different octet patterns or include unintended matches). Option D is wrong because `src_ip!=10.0.0.0/8` uses an inequality operator that compares the IP as a string, not a subnet, so it will not perform CIDR matching and will likely exclude no IPs or produce incorrect results.

Full explanation →

200

MCQmedium

A network operations team uses Splunk to analyze firewall logs. They need to identify top talkers (source IPs with highest total bytes) over the last hour. The current search: 'index=firewall | stats sum(bytes) as totalBytes by src_ip | sort -totalBytes | head 10' takes 5 minutes to complete. They want to make it faster. The environment has 5 indexers with default configurations. The data volume is 100 GB/day. Which action will most improve search performance?

A.Add 'earliest=-1h' to the search to restrict the time range explicitly.

B.Replace head 10 with limit 10 at the end of the pipeline.

C.Use map to run the search per indexer.

D.Set the search's parallelism to 'auto' in the commands.

AnswerA

Limits the data scanned by the indexers from the start.

Why this answer

Explicitly adding 'earliest=-1h' restricts the search to the last hour at the search head level, allowing Splunk to use time-based index metadata to skip irrelevant buckets entirely. Without an explicit time range, Splunk may scan all available data, dramatically increasing I/O and search time. This is the most impactful optimization for time-bound searches over large datasets.

Exam trap

The trap here is that candidates may overlook the most fundamental Splunk optimization—explicit time range—and instead focus on command-level tweaks like 'limit' or parallelism, which have negligible or negative impact on performance.

How to eliminate wrong answers

Option B is wrong because 'head 10' and 'limit 10' are functionally identical in Splunk; 'limit' is simply an alias for 'head' and does not change performance. Option C is wrong because the 'map' command runs a subsearch for each result, which would multiply the workload and degrade performance, not improve it. Option D is wrong because parallelism in Splunk is controlled by the search head and indexers automatically; setting it to 'auto' is the default and does not override the need for a time range restriction.

Full explanation →

201

MCQhard

A Splunk administrator notices that a scheduled saved search `Daily Summary` fails every day at 2:00 AM with the error "Search job expired due to inactivity." The search runs against a large index and takes about 30 minutes to complete. What is the most likely cause?

A.The user who owns the saved search does not have permissions to run it at that time.

B.The indexer has reached its license quota and stops processing.

C.The scheduled search is configured with a time limit shorter than 30 minutes.

D.The search is consuming too much disk space.

AnswerC

Search job expiration occurs when the time limit is exceeded.

Why this answer

The error 'Search job expired due to inactivity' indicates that the scheduled search was terminated before it could complete. In Splunk, saved searches have a configurable time limit (default 10 minutes) that specifies the maximum runtime before the search is killed. Since the search takes 30 minutes, the time limit must be set to less than 30 minutes, causing the premature termination.

Exam trap

The trap here is that candidates often confuse the 'inactivity' error with user permissions or license issues, but it specifically refers to the search job's runtime exceeding the configured time limit in the saved search's dispatch settings.

How to eliminate wrong answers

Option A is wrong because the error message is about job expiration, not permissions; Splunk's role-based access controls do not restrict execution time based on ownership. Option B is wrong because a license quota violation would cause indexing to stop or produce a 'license violation' warning, not a search job expiration error. Option D is wrong because disk space consumption would cause indexing or storage failures, not a search job timeout; the error is specifically about the search job being inactive, not about resource exhaustion.

Full explanation →

202

MCQhard

A transaction search that uses a large maxspan and high-cardinality fields is failing due to memory limitations. Which approach can best reduce memory usage without changing the transaction logic?

A.Use the 'stats' command with values() instead of transaction.

B.Use the 'fields' command before transaction to retain only the correlation fields and _time.

C.Increase the maxpause value to reduce number of open transactions.

D.Set keepevicted=true to offload evicted events.

AnswerB

Correct: minimizes field count.

Why this answer

Using the 'fields' command before 'transaction' to retain only the correlation fields and _time reduces the amount of data held in memory for each event, directly addressing memory limitations. Option A (using 'stats' with values()) changes the logic and does not preserve the event boundary behavior of transaction. Option C (increasing maxpause) does not reduce memory; it may increase the number of concurrent open transactions.

Option D (setting keepevicted=true) actually increases memory usage by keeping evicted events.

Full explanation →

203

MCQeasy

A Splunk admin wants to create a reusable macro that accepts a time range parameter and searches all indexes for events within that range. The macro will be used in dashboards and reports. Which macro definition is correct?

A.define my_search($timerange) [search index=* earliest=$timerange]

B.define my_search($timerange$) search index=* earliest=$timerange$

C.define my_search($timerange$) <search index=* earliest=$timerange$>

D.define my_search($timerange$) [search index=* earliest=$timerange$]

AnswerD

Correct macro definition with proper argument syntax and brackets.

Why this answer

Macro definitions use the format `define macro_name($arg$) [definition]`, where arguments are enclosed in dollar signs and the definition is enclosed in square brackets. Option A is incorrect because it uses `$timerange` without closing dollar sign. Option B is incorrect because it lacks the enclosing brackets.

Option C is incorrect because it uses angle brackets instead of square brackets. Only option D correctly uses both the argument syntax and brackets.

Full explanation →

204

MCQhard

An analyst needs to create a time-series chart showing the percentage of total HTTP status codes per day. Which approach is most efficient?

A.timechart count by status | eventstats sum(count) as total by _time | eval pct = round(count/total*100,2) | chart first(pct) over _time by status

B.chart count by status over _time | eval pct = count / sum(count) * 100

C.timechart count by status | addtotals | eval pct = count / total * 100

D.timechart count by status | append [timechart count] | eval pct = count / [| timechart count] * 100

AnswerA

This correctly computes percentages per time bucket and presents them in a time series.

Why this answer

Using timechart to get counts by status, then eventstats to compute total per day, and eval to calculate percentage, is efficient and clear. Option B is incorrect because using chart with a single stats command cannot compute percentages across groups per time bucket. Option C is incorrect because addtotals adds overall totals but does not compute per-day percentages.

Option D is incorrect because overcomplicates with subsearches.

Full explanation →

205

MCQhard

A company has events from multiple data sources that share a common 'request_id'. They want to correlate events from different sources (e.g., web, app, database) into a single transaction per request. However, the timestamps across sources are not synchronized, causing some events to appear out of order. Which approach is best to ensure correct grouping?

A.Use `eventstats count by request_id` to correlate counts

B.Use `sort _time | transaction request_id maxspan=10m`

C.Use `transaction request_id` and rely on Splunk to automatically reorder

D.Use `transaction request_id maxspan=1m` and ignore out-of-order events

AnswerB

Sorting by time ensures events are processed in chronological order, and a 10-minute maxspan accommodates timestamp skew.

Why this answer

Setting a larger maxspan and using `sort _time` before transaction can help reorder events, but the most reliable method is to use `transaction request_id` with a generous maxspan and, if needed, use `sort 0 _time` before transaction to ensure time order.

Full explanation →

206

MCQmedium

A security analyst sets up a saved search alert to trigger when more than 100 failed logins occur in 5 minutes. To avoid alert fatigue, they want to suppress the alert if the number of failed logins is the same as the previous evaluation. Which alert action setting should they configure?

A.Enable 'Alert throttling' based on the 'src' field.

B.Enable 'Alert suppression' and set 'Suppress if results are the same as the previous search'.

C.Set the 'Throttle' field to suppress alerts for a specified time window.

D.Configure 'Alert severity' to low and set a delay.

AnswerB

This option compares the result set to the previous run and suppresses if unchanged.

Why this answer

'Alert suppression' with the setting 'Suppress if results are the same as the previous search' directly addresses the requirement to avoid alert fatigue when the number of failed logins is unchanged. Option A, 'Alert throttling', limits the frequency of alerts based on a time interval or field values, not comparison of result sets. Option C's throttle field is typically for throttling per field value, not condition-based suppression.

Option D's severity and delay do not suppress based on result comparison.

Full explanation →

207

MCQmedium

Refer to the exhibit. What is the purpose of this configuration?

A.It creates a search-time field extraction for clientip and userid.

B.It defines a transaction type that can be used in search with `transaction mytransaction` to group events by clientip and userid with given time parameters.

C.It configures the transaction command to run automatically on all data.

D.It defines a transaction type that can be used in search with `transaction mytransaction` to group events by clientip and userid, ignoring the specified time parameters.

AnswerB

Correct. The stanza in transaction.conf defines a named transaction type (mytransaction) which can be invoked in a search using `transaction mytransaction`. It groups events by clientip and userid and uses the maxpause, maxevents, and other settings to determine transaction boundaries.

Why this answer

This stanza defines a named transaction type in transaction.conf. It can be invoked in a search as `transaction mytransaction` to group events by clientip and userid with the specified time parameters (maxpause, maxevents).

Full explanation →

208

Drag & Dropmedium

Arrange the steps to configure role-based access control in Splunk.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct sequence for configuring role-based access control in Splunk involves first creating or editing a role under Settings > Access Controls > Roles, then assigning capabilities (such as search and index management), followed by setting resource restrictions like index access, and finally saving. This ensures the role is fully defined before being assigned to users. Common mistakes include mixing up the order of capabilities and index restrictions, or mistakenly starting with user assignment.

Full explanation →

209

MCQeasy

What is the purpose of an automatic lookup?

A.To automatically validate lookup field names.

B.To automatically update a lookup file when the CSV changes.

C.To automatically create a lookup table from search results.

D.To automatically apply a lookup to events based on a source type or index at search time.

AnswerD

Automatic lookups enrich events transparently when data is indexed or searched.

Why this answer

An automatic lookup is configured in transforms.conf or props.conf to automatically apply a lookup table to events based on sourcetype or index at search time. This enriches events with additional fields without requiring the lookup command in the search. Option A is incorrect because automatic lookups do not validate field names; validation must be done separately.

Option B describes the outputlookup command, which writes to a lookup file. Option C is incorrect because automatic lookups do not create tables from search results; that is done by the inputlookup or outputlookup commands. Option D correctly describes the purpose of an automatic lookup.

Full explanation →

210

MCQhard

A telecom company monitors call detail records (CDR). Each call has a unique call_id, and events are generated at each network node (setup, ringing, answer, hangup) with timestamps. The events are from different sourcetypes (cdr_setup, cdr_ring, etc.) and are indexed in near real-time. The analyst needs to correlate all events for the same call_id to calculate call duration. The current search is: `index=telecom sourcetype=cdr_* | transaction call_id maxspan=2h`. This search works but sometimes produces huge transactions (100+ events) due to noisy data, causing memory errors. The analyst has identified that each call should have exactly 4 events: setup, ringing, answer, hangup. Which approach would best correlation with minimal resource usage?

A.Use `transaction call_id maxevents=4 maxspan=2h` to limit to exactly 4 events.

B.Use `transaction call_id maxspan=2h` and then filter using `where mvcount(_raw) = 4`.

C.Use `eventstats count by call_id` and then filter.

D.Use `search` with `call_id=*` and then use `streamstats` to calculate duration per call.

AnswerA

Correct: maxevents=4 ensures only the expected events are grouped, reducing memory and processing time.

Why this answer

`maxevents=4` directly limits the transaction to exactly four events per call_id, preventing memory errors from noisy data while ensuring each transaction contains the expected setup, ringing, answer, and hangup events. This constraint is applied during the transaction command itself, reducing resource usage by discarding oversized groups immediately rather than post-processing.

Exam trap

Splunk often tests the misconception that post-filtering (e.g., `where mvcount(_raw) = 4`) is equivalent to using `maxevents`, but the trap is that post-filtering does not prevent memory errors during the transaction assembly phase.

How to eliminate wrong answers

Option B is wrong because `mvcount(_raw) = 4` filters after the transaction command has already built the oversized transactions, meaning memory errors still occur during the transaction phase. Option C is wrong because `eventstats count by call_id` does not correlate events into a single transaction; it only adds a count field to each event, failing to group events for duration calculation. Option D is wrong because `streamstats` operates on a per-event basis without grouping by call_id, so it cannot correlate the four required events to compute call duration.

Full explanation →

211

Matchingmedium

Match each Splunk knowledge object to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Defines how to extract fields from raw data

Categorizes events based on a search query

Assigns key-value pairs to events for filtering

Maps field values to additional information

Provides a structured, normalized view of data

Why these pairings

Knowledge objects in Splunk help organize and enrich data. Event types group events by criteria, Tags label field values, Lookups add external data, and Macros store reusable search fragments. Common confusions arise between these similar but distinct objects.

Full explanation →

212

MCQmedium

An analyst uses the following search: `... | timechart span=1h count by status`. What is the purpose of the span argument?

A.It limits the number of status values displayed.

B.It groups events into 1-minute intervals.

C.It sets the time range of the chart.

D.It defines the time interval for each data point (1 hour).

AnswerD

span=1h means each data point aggregates events from a 1-hour window.

Why this answer

The span argument in the timechart command specifies the time interval for each data point or bucket. Here, span=1h means each bucket represents one hour. Option A is incorrect because span does not limit the number of status values; that's controlled by other means.

Option B is incorrect because span=1h groups events into 1-hour, not 1-minute, intervals. Option C is incorrect because the time range of the chart is set by the search time picker, not the span argument.

Full explanation →

213

MCQhard

A security analyst wants to find IP addresses that have been involved in both login failures and successful logins within a 5-minute window. Which approach is most efficient?

A.Using the transaction command

B.Using the appendcols command

C.Using a subsearch

D.Using the stats command with values

AnswerA

Groups events by IP within a time span, ideal for this scenario.

Why this answer

Using the transaction command. The transaction command groups events from the same IP address (or other field) within a specified time window, such as 5 minutes, making it ideal for correlating login failures and successes from the same source. Option B (appendcols) is inefficient because it requires manual field matching and does not handle time windows.

Option C (subsearch) is resource-intensive and not designed for event correlation across time. Option D (stats with values) can aggregate fields but cannot guarantee temporal proximity between events. Thus, transaction is the most efficient and appropriate command for this scenario.

Full explanation →

214

MCQeasy

A user has created a dashboard panel using a 'chart' command with 'datacount by host'. The chart shows counts per host, but the hosts appear in alphabetical order. The user wants to sort the chart by count descending, so that the host with the most events appears first. The search is: index=main sourcetype=access | chart count by host. The dashboard is built using Simple XML. Which approach should be used to achieve the desired sorting?

A.Use the 'top' command instead of 'chart' to automatically sort by count.

B.Use 'eventstats' to compute counts and then sort by count.

C.Add '| sort -count' after the chart command in the search.

D.Use the chart properties panel in the dashboard editor to set sorting by count descending.

AnswerC

Sort after chart reorders the results.

Why this answer

Adding '| sort -count' after the chart command sorts the results by count in descending order, making the host with the most events appear first. Option A is incorrect because the 'top' command produces a different table format (with count and percent fields) and is not appropriate if the desired output is a chart. Option B is incorrect because 'eventstats' adds a statistical field to events but does not replace the chart command or sort the results; it would require additional steps.

Option D is incorrect because the Simple XML chart properties panel does not include a sorting option for chart data; sorting must be performed within the search itself.

Full explanation →

215

MCQmedium

Refer to the exhibit. A security analyst notices that some transactions have a duration greater than 600 seconds even though maxpause is set to 5 minutes (300 seconds). What is the most likely reason?

A.The transaction command is including events that are more than 5 minutes apart because the maxpause is ignored when maxspan is set.

B.The eventcount field is inflated, causing duration to be calculated incorrectly.

C.The duration field represents milliseconds, so 600 seconds is actually 0.6 seconds.

D.The maxspan setting of 30 minutes allows the total transaction duration to reach up to 1800 seconds.

AnswerD

Maxspan limits the total elapsed time from first to last event; 600 seconds is within 30 minutes.

Why this answer

The `maxspan` parameter in the transaction command sets an upper limit on the total duration of the transaction from the first to the last event, regardless of the `maxpause` setting. With `maxspan=30m` (1800 seconds), a transaction can have a total duration up to 1800 seconds, even if individual gaps between events exceed `maxpause=5m` (300 seconds). The `maxpause` only limits the idle time between consecutive events, not the overall span, so transactions with gaps larger than 300 seconds but within the 1800-second span are still valid.

Exam trap

Splunk often tests the distinction between `maxpause` and `maxspan`, where candidates mistakenly think `maxpause` alone controls the total transaction duration, ignoring that `maxspan` can extend the overall time window.

How to eliminate wrong answers

Option A is wrong because `maxpause` is not ignored when `maxspan` is set; both parameters work together, with `maxpause` limiting gaps between events and `maxspan` limiting the total transaction duration. Option B is wrong because the `eventcount` field does not affect the calculation of `duration`; `duration` is derived from the timestamps of the first and last events in the transaction, not from event count. Option C is wrong because the `duration` field in the transaction command output is in seconds, not milliseconds; 600 seconds is indeed 600 seconds, not 0.6 seconds.

Full explanation →

216

MCQmedium

Refer to the exhibit. This search is intended to find users with average duration above overall average. However, it returns no results. Why?

A.eventstats should be after stats

B.The where clause should use the 'search' command

C.overall_avg is not available in the where clause because it is created in eventstats

D.The search requires a subquery to compute overall_avg

AnswerC

Stats output does not include fields from prior commands unless preserved.

Why this answer

The search uses eventstats to compute overall_avg, adding it to each event. Then the stats command groups by user, computing user_avg, but it does not retain overall_avg in the output. Therefore, when the where clause references overall_avg, that field no longer exists, causing the search to return no results.

Option A is wrong because eventstats before stats is the correct order to compute overall_avg from all events. Option B is wrong because the where clause is appropriate for filtering; no need to use search command here. Option D is wrong because a subquery is not required; the issue is the field being dropped.

Full explanation →

217

MCQhard

Refer to the exhibit. This search returns an error. What is the most likely cause?

A.The timechart command requires a _time field which is not present after stats

B.The eval command cannot be used before timechart

C.The status_group field is not available after timechart because it was created in eval

D.The stats command aggregates data, so timechart cannot use the aggregated count field

AnswerA

Stats does not preserve _time unless explicitly used in a by clause.

Why this answer

The error occurs because the `stats` command removes the `_time` field from the events, and `timechart` requires a valid `_time` field to create time-based buckets. Without `_time`, `timechart` cannot generate the time axis, resulting in a search error. This is a common pitfall when chaining `stats` before `timechart` without preserving the time field.

Exam trap

Splunk often tests the misconception that `stats` preserves `_time` by default, leading candidates to overlook that `timechart` requires an explicit time field in the result set.

How to eliminate wrong answers

Option B is wrong because `eval` can be used before `timechart` without issue, as long as the required `_time` field is present. Option C is wrong because `status_group` is created by `eval` and is available to `timechart`; the error is not about field availability but the missing `_time` field. Option D is wrong because `timechart` can use aggregated count fields from `stats`; the real problem is that `stats` removes `_time`, not that the count field is incompatible.

Full explanation →

218

MCQhard

An administrator wants to correlate events from the same session but the events span up to 30 minutes apart. The transaction command is being considered. Which transaction option is most appropriate to ensure sessions are correctly grouped without artificially high memory usage?

A.| transaction sessionid maxspan=30m

B.| transaction sessionid maxspan=30m maxpause=5m

C.| transaction sessionid maxevents=100

D.| transaction sessionid maxspan=30m keepevicted=true

AnswerB

Correctly defines time window and pause to group sessions

Why this answer

The `maxspan=30m` ensures events spanning up to 30 minutes are grouped into the same transaction, while `maxpause=5m` prevents the transaction from remaining open indefinitely by closing it after 5 minutes of inactivity. This combination correctly groups sessions without keeping the transaction open for the full 30 minutes, which would artificially increase memory usage by holding events in the buffer.

Exam trap

Splunk often tests the misconception that `maxspan` alone is sufficient to control memory usage, when in fact `maxpause` is critical to close transactions during idle periods and prevent excessive memory consumption.

How to eliminate wrong answers

Option A is wrong because using only `maxspan=30m` without `maxpause` means the transaction will remain open for the entire 30-minute span even if there are long gaps between events, causing high memory usage as events are held in the buffer. Option C is wrong because `maxevents=100` limits the number of events per transaction but does not address the time span or pause requirements, so sessions spanning 30 minutes may be split or incomplete. Option D is wrong because `keepevicted=true` retains evicted (incomplete) transactions in the output, which does not help control memory usage and may actually increase it by including partial groups.

Full explanation →

219

MCQhard

A Splunk admin wants to create a saved search that triggers an alert when the average CPU usage across all servers exceeds 80% over a 5-minute window. The data is in a 'perfmon' sourcetype. Which search best fits this requirement?

A.index=os sourcetype=perfmon counter="% Processor Time" | timechart avg(Value) as avg_cpu by host | where avg_cpu > 80

B.index=os sourcetype=perfmon counter="% Processor Time" earliest=-5m latest=now | stats avg(Value) as avg_cpu by host | where avg_cpu > 80

C.index=os sourcetype=perfmon counter="% Processor Time" | streamstats avg(Value) as avg_cpu by host | where avg_cpu > 80

D.index=os sourcetype=perfmon counter="% Processor Time" earliest=-5m latest=now | bucket _time span=5m | stats avg(Value) as avg_cpu by host | where avg_cpu > 80

AnswerD

Correctly batches events into 5-minute buckets per host and filters where average exceeds 80.

Why this answer

It uses `earliest=-5m latest=now` to restrict the time range to the last 5 minutes, `bucket _time span=5m` to explicitly define the 5-minute window (even though the range is exactly 5 minutes, this ensures proper grouping for saved searches that may run later), `stats avg(Value) as avg_cpu by host` to compute the average per host within that window, and `where avg_cpu > 80` to filter hosts exceeding 80%. Option A uses `timechart`, which creates a separate series per time bucket and host, making the `where` clause ineffective (it would try to compare a field that doesn't exist). Option B omits the `bucket`, so the average is computed over the entire 5-minute range without explicit windowing, which can cause issues if the saved search runs with a different time range.

Option C uses `streamstats`, which calculates a running average rather than a fixed-window average, not matching the requirement.

Full explanation →

220

Drag & Dropmedium

Order the steps to create a workflow action in Splunk.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Workflow actions are created by specifying a label, action type, and URI with field references.

Full explanation →

221

MCQhard

An analyst needs to create a visualization that shows the relationship between source IP and destination port in network traffic. Which visualization type is most appropriate?

A.Choropleth map

B.Sankey diagram

C.Single value

D.Column chart

AnswerB

Sankey diagrams effectively illustrate flows between two dimensions.

Why this answer

A Sankey diagram is designed to show flow relationships between sources and destinations. Choropleth maps are geographic, single values show one number, and column charts are for comparisons.

Full explanation →

222

Multi-Selecteasy

Which TWO SPL commands can be used to create a time-based chart showing event counts over time? (Select two.)

Select 2 answers

A.eventstats

B.chart (with time span)

C.timechart

D.where

E.stats

AnswersB, C

chart can be used with an explicit span over _time to produce a similar result.

Why this answer

The correct answers are B and C. timechart automatically creates a time-based chart showing event counts over time by default. chart with a time span (e.g., chart count over _time span=1h) also creates a time-based chart. eventstats (A) adds statistics to existing events but does not produce a chart. where (D) filters events based on a condition. stats (E) returns a table of statistics but does not produce a chart.

Full explanation →

223

MCQeasy

A security analyst is investigating a potential breach. They have a search that uses the transaction command to group events by session_id and calculates the total bytes transferred per session. However, the search takes over 30 minutes to complete on a 24-hour time range. The environment has 10 indexers with default settings. The analyst needs to reduce search time while preserving the ability to group by session_id. Which course of action should they take?

A.Pre-aggregate events by session_id using 'stats values(*) as * sum(bytes) as total_bytes by session_id' before the transaction command.

B.Use an append command to add a subsearch that pre-filters events.

C.Replace transaction with the 'streamstats' command to compute running totals.

D.Add the 'local' keyword to the transaction command to force it to run on a single indexer.

AnswerA

Reduces the number of events per session, making transaction faster.

Why this answer

Pre-aggregating events by session_id using stats with values(*) and sum(bytes) before the transaction command reduces the number of events the transaction command must process. The transaction command is resource-intensive as it correlates events across time; fewer input events significantly decrease execution time. The stats command runs in parallel across indexers, maintaining distributed processing.

Other options: B adds overhead via subsearch, C (streamstats) does not group events like transaction, and D forces single-indexer processing, slowing performance.

Full explanation →

224

MCQeasy

A security analyst needs to monitor failed login attempts across multiple Windows domain controllers. The environment has a custom sourcetype 'WinEventLog:Security' and the data is indexed under 'windows_security'. The analyst wants to create a saved search that runs every 10 minutes, searches for EventCode 4625 (failed logon), and triggers an alert if more than 10 failures occur from the same source IP within the last 10 minutes. The saved search should use the Common Information Model (CIM) to ensure compatibility with other security apps. Which of the following saved search definitions best meets these requirements?

A.`| from datamodel:Authentication.All_Authentication where Authentication.EventCode=4625 | search Authentication.app=windows | timechart span=10m count by Authentication.src | where count > 10`

B.`index=windows_security sourcetype=WinEventLog:Security EventCode=4625 | stats count by src_ip | where count > 10`

C.`| from datamodel:Authentication.Failed_Authentication | where EventCode=4625 | stats count by src_ip | where count > 10`

D.`index=windows_security EventCode=4625 | transaction src_ip maxspan=10m | where eventcount > 10`

AnswerA

Uses CIM data model, correct field, and timechart for aggregation.

Why this answer

It uses the `from datamodel` command to query the CIM Authentication data model, specifically the `All_Authentication` dataset filtered for EventCode 4625 and Windows (`Authentication.app=windows`). The `timechart span=10m count by Authentication.src` then counts failures per source IP in 10-minute buckets, and the `where count > 10` triggers the alert only when the threshold is exceeded. This approach ensures CIM compatibility, uses the correct data model object, and respects the 10-minute sliding window required by the use case.

Exam trap

The trap here is that candidates often pick Option C because 'Failed_Authentication' sounds correct, but they miss that it may not expose the raw EventCode field and lacks a time-bounded aggregation, while Option A correctly uses the parent dataset `All_Authentication` with explicit filtering and `timechart` for the sliding window.

How to eliminate wrong answers

Option B is wrong because it uses `index=windows_security sourcetype=WinEventLog:Security` directly instead of the CIM data model, breaking compatibility with other security apps; it also uses `stats count by src_ip` without a time window, so it counts all-time failures rather than within the last 10 minutes. Option C is wrong because it queries `Authentication.Failed_Authentication` which is a child dataset that may not contain the raw EventCode field directly, and it uses `stats count by src_ip` without a time-bounded window, failing the 10-minute requirement. Option D is wrong because it uses `transaction src_ip maxspan=10m` which groups events into transactions but does not enforce a fixed 10-minute sliding window for counting; `transaction` can merge events across gaps and may produce inaccurate counts, plus it does not use the CIM data model.

Full explanation →

225

MCQeasy

A user wants to create a macro that calculates the average response time for web requests. The macro should accept a field name as an argument and return the average. Which syntax is correct for defining the macro?

A.`stats avg($field$) | eval avg_response=$result$`

B."stats avg($field$) as avg_response"

C.`stats avg($field$) as avg_$field$`

D.`stats avg($field$) as avg_response`

AnswerD

Correct because it uses the proper syntax: `stats avg($field$) as avg_response` with the argument placeholder `$field$` and a static alias `avg_response`, which is the standard way to return a single computed value from a macro.

Why this answer

In Splunk macro definitions, the argument placeholder syntax is `$field$` (with dollar signs), and the macro body must be a valid search string. The `stats avg($field$) as avg_response` correctly uses the argument in a stats command and assigns a static alias, which is the standard way to return a single computed value from a macro. Option C is wrong because although it uses valid syntax with `$field$`, it creates a dynamic alias (`avg_$field$`) which is not appropriate for a macro that needs to return a fixed field name for the average.

The requirement is to return the average, so a static alias like `avg_response` is correct.

Exam trap

The trap here is that candidates often confuse macro argument syntax with eval variable syntax (e.g., `$result$`) or incorrectly assume that the macro definition must be quoted, leading them to pick options A or B, while the correct syntax uses unquoted search commands with `$argname$` placeholders.

How to eliminate wrong answers

Option A is wrong because it uses `$result$` which is not a valid macro argument placeholder; macros only recognize `$argname$` syntax, and the `eval` command is unnecessary since `stats` already produces the result. Option B is wrong because it encloses the macro definition in double quotes, which would cause Splunk to treat it as a literal string rather than a search command, breaking the macro. Option C is wrong because `as avg_$field$` dynamically names the output field based on the argument value, which is not the intended behavior — the requirement is to return a fixed field name 'avg_response' regardless of the input field name.

Full explanation →

Page 3 of 7

All pages

Practice SPLK-1002 by domain

Target a specific domain to shore up weak areas.

Advanced Searching and Statistics Macros, Saved Searches and CIM Advanced Visualization and Lookups Transactions and Event Correlation

See all domains with question counts →